How To Protect Your Business Domains From Expiring (And Turning Into A Security Incident) — A Practical Playbook For Singapore SMEs

Cloud computing often gets explained as a shared, highly secure vault: you rent space, you control access, and the provider handles the building.

Domains work the same way, except the "address on the vault" is your domain name.

Lose the address, and clients can be redirected to the wrong door.

We have seen domain control failures on the news recently.

Recognise Why Domain Expiry Is An Information Security Risk

A surprising moment usually triggers this conversation: a CFO forwards a screenshot showing a client email bounce, and the website displays a parking page full of adverts.

Domain expiry looks administrative until the first hour of impact. Domain security sits directly under availability and integrity, which means operational continuity and client trust.

What Really Happens When A Domain Expires: The Lifecycle In Plain English

A domain name behaves like a lease. Miss the renewal, and the registrar starts a countdown.

A typical lifecycle looks like this (registrar-specific, but broadly consistent):

• Expiry date hits and the domain can stop resolving, which means website and email can fail immediately.
• Grace period (often 30–45 days) follows, which means renewal is usually possible at normal cost.
• Redemption period can follow, which means recovery fees often jump to around S$150 (or equivalent) on top of renewal.
• Pending delete (about 5 days) follows, which means nobody can renew and the domain is about to drop.
• Re-registration/auction opens, which means attackers can buy the domain and reuse your brand equity.

Do this today (10 minutes): Check the expiry date for your primary domain and your email domain in your registrar portal, and record both in one shared place.

Business Impact You Can Measure: Downtime, BEC Exposure, Brand Damage, And Recovery Costs

Domain expiry creates measurable failures, not abstract risk.

• Downtime: Email bounces and website errors appear, which means client servicing slows or stops.
• One missed renewal can create a full morning of disruption, which means a team of 20 losing 3 hours each becomes 60 hours of lost productivity.
• BEC exposure: Attackers can re-register and set up lookalike mailboxes, which means payment instructions and invoices can be spoofed with higher success.
• Historic trust and past email threads raise credibility, which means finance teams become a target.
• Brand damage: SEO value and backlinks can be redirected, which means reputational harm persists even after recovery.
• Recovery costs: Redemption fees, emergency consulting, and potential legal action follow, which means the "cheap renewal" becomes a four-figure incident.

Do this today (15 minutes): Estimate your one-day cost of email outage (headcount × average hourly cost × 6 hours), and write the number into your risk register.

Compliance Angle For Singapore: Where Domain Control Maps To TRM, ISO 27001:2022, And Audit Expectations

TRM discussions frequently circle back to operational resilience and control over critical technology components, which means auditors will ask who owns the domain, who can change DNS, and how renewals are assured.

ISO/IEC 27001:2022 also points you towards this outcome through asset management expectations (Annex A controls such as A.5.9 and the broader asset/control theme), which means domains should appear as managed assets with defined ownership, acceptable use, and protective controls.

Do this today (20 minutes): Add "Domains and DNS" as a line item under your information asset register, with an owner and a review date.

Identify Your Domain Attack Surface And Single Points Of Failure

Discovery often arrives with a surprise: a marketing microsite from 2019 still exists, and the domain renewal notice goes to somebody who left.

Domain security improves fastest when the attack surface becomes visible, which means an inventory comes before tools.

Inventory What You Own: Domains, Variants, And Brand-Protection Names

Most SMEs in Singapore do not only own one domain. A typical set includes:

• Primary brand domain, which means your public identity.
• Email domain (sometimes separate), which means your communications trust anchor.
• Variants and common misspellings, which means protection against spoofing and typos.
• Campaign domains, which means short-lived business experiments.

A practical inventory approach:

• Export domains from each registrar, which means you avoid relying on memory.
• Search finance, HR, and procurement inboxes for "renewal", "WHOIS", and registrar names, which means you find forgotten assets.
• Review corporate card statements for registrar charges, which means you identify hidden renewals.

Do this today (25 minutes): Create a single spreadsheet called "Domain Register" and list every domain you can find, even if you are unsure who owns it.

Map Business Dependencies: Website, Email, Client Portals, SSO, VPN, MDM, And Third-Party SaaS

Domains rarely serve only websites. A domain can underpin:

• MX records for email, which means mail flow depends on DNS.
• SSO identifiers (Azure AD/Entra ID, Okta), which means logins and conditional access can break.
• VPN endpoints, which means remote access fails when DNS changes.
• MDM enrolment and device compliance, which means laptop and mobile controls can drift.
• Client portals and file-sharing links, which means client servicing becomes unreliable.

We have seen a single DNS change unintentionally affect Microsoft 365 mail routing within minutes, which means the blast radius can be larger than expected.

Do this today (30 minutes): For your primary domain, list the top 10 dependent services (email, website, SSO, VPN, client portal) and note the business owner for each.

Find The ‘Bus Factor': Who Can Renew, Who Gets Alerts, And What Happens When They Leave

A painful pattern shows up during staff transitions: renewal alerts go to a personal mailbox that no longer exists, which means the organisation becomes blind.

Bus factor questions that matter:

• Who has registrar admin access, which means who can transfer ownership.
• Who receives renewal notices, which means who gets early warning.
• Who can approve payment, which means whether renewal can happen inside a 48-hour window.

A simple target helps: at least two named people plus a role-based distribution list, which means continuity through leave, resignations, and travel.

Do this today (15 minutes): Name a primary and secondary person who can renew domains, and confirm both can log in.

Spot High-Risk Configurations: Split Registrars, Shadow IT Domains, Personal Accounts, And Unverified Contact Details

Domain takeovers tend to begin with weak operational hygiene, which means configuration risk matters.

High-risk signals include:

• Split registrars, which means renewals and contact details get inconsistent.
• Shadow IT domains bought by agencies, which means ownership may not sit with your company.
• Personal registrar accounts, which means legal control and recovery become messy.
• Unverified WHOIS/registrant contacts, which means you cannot receive transfer or renewal notices.

Do this today (20 minutes): Check whether registrant email and phone details are current for your primary domain, and update them to role-based contacts.

Set A Domain Governance Baseline You Can Defend In An Audit

A small governance shift can feel transformative: once ownership is explicit, renewal becomes routine rather than heroic.

Governance for domain security is less about paperwork and more about predictable outcomes, which means fewer surprises during reporting season.

Choose Ownership And Accountability: Name A Domain Owner, A Backup, And Clear Approvals

A workable model assigns:

• Domain Owner (business-accountable), which means somebody cares about consequences.
• Technical Custodian (IT/MSP), which means changes are implemented safely.
• Backup approver, which means renewals do not stall during leave.

In our experience supporting CBD firms near Marina Bay and Tanjong Pagar, the owner role often fits Operations or Compliance, which means renewal is treated as business continuity rather than a website task.

Do this today (20 minutes): Assign one named owner and one backup for your primary and email domains, and record them in your Domain Register.

Use Role-Based Emails And Distribution Lists (Not Personal Mailboxes) For Registrar Accounts

Registrar access tied to a personal mailbox fails predictably, which means a resignation becomes a security event.

A better pattern:

• Use domains@company.com or it-ops@company.com, which means continuity.
• Back the mailbox with a distribution list (for example, 3 recipients), which means multiple people see renewal notices.
• Ensure mailbox access is protected with MFA, which means fewer account takeovers.

Do this today (15 minutes): Create a role-based mailbox for registrar notifications and add at least three recipients (IT, Ops, Compliance).

Define Your ‘90-Day Rule': Renewal Windows, Escalations, And When To Pre-Pay Multi-Year

A 90-day rule reduces panic, which means renewal happens before urgency.

A practical cadence:

• 90 days: verify payment method and contact details, which means no last-minute failure.
• 60 days: confirm renewal decision and approvals, which means procurement stays aligned.
• 30 days: execute renewal or pre-pay multi-year, which means you avoid accidental expiry.

Multi-year renewals (2–5 years) can make sense for core domains, which means fewer annual touchpoints. Auto-renew still needs oversight, which means monitoring remains necessary.

Do this today (10 minutes): Set calendar reminders at 90/60/30 days for your next renewal date, shared with your distribution list.

Document The Minimum Evidence Set: Invoices, WHOIS/Registrant Details, Renewal Settings, And Access Logs

Audit readiness comes from a small evidence set, which means you avoid recreating history under pressure.

Minimum evidence that usually satisfies internal reviews:

• Renewal invoices/receipts, which means proof of payment.
• Current registrant and admin contacts, which means proof of control.
• Auto-renew and lock settings screenshots, which means proof of configuration.
• Registrar access logs or admin list exports, which means traceability.

Do this today (30 minutes): Create a folder called "Domain Evidence" and save one PDF invoice plus screenshots of registrant details and renewal settings for your primary domain.

Harden Registrar And DNS Access (Where Most Takeovers Begin)

A takeover rarely starts with sophisticated hacking.

A takeover often starts with one compromised mailbox or one weak registrar login, which means registrar and DNS controls deserve the same attention as Microsoft 365 admin roles.

Consolidate Registrars (Where Sensible) To Reduce Operational Misses

Multiple registrars increase error rates, which means renewal notices scatter and ownership becomes unclear.

Consolidation benefits include:

• Fewer logins to secure, which means less credential risk.
• A single renewal calendar, which means fewer misses.
• Standardised lock and contact settings, which means predictable control.

Consolidation is not always appropriate for every domain, which means exceptions can exist for legacy or contractual reasons.

Do this today (20 minutes): List which registrar holds each domain and identify whether two registrars could become one within the next quarter.

Enforce Strong Authentication: MFA, Passkeys Where Available, And Conditional Access

Strong authentication blocks common takeovers, which means fewer account resets and fewer unauthorised transfers.

• MFA reduces credential-only compromise, which means stolen passwords alone do not grant access.
• Passkeys (where supported) reduce phishing success, which means fewer login prompts can be intercepted.
• Conditional access (through identity providers where possible) limits risky logins, which means access from unusual geographies triggers challenge or block.

Google's research has shown MFA meaningfully reduces account hijacking, which means basic controls provide large risk reduction (see Google Security Blog on 2-Step Verification effectiveness).

Do this today (15 minutes): Turn on MFA for registrar admin accounts and record recovery codes in a controlled vault.

This is for: every SME. This is not for: teams unable to manage MFA recovery safely.

Limit Privilege With Separate Roles: Billing Vs DNS Changes Vs Ownership Transfers

Role separation reduces impact of one compromised account, which means fewer catastrophic failures.

A sensible split:

• Billing-only users, which means renewals can be paid without DNS access.
• DNS editors for routine changes, which means web updates stay controlled.
• Ownership/transfer admins limited to a few people, which means transfers cannot happen casually.

Do this today (25 minutes): Review registrar users and downgrade any account that does not need transfer-level access.

This is for: firms with more than one IT or Ops staff member. This is not for: micro-businesses where one person must do all roles (though compensating controls still help).

Enable Registrar Safeguards: Transfer Locks, Registry Lock (When Appropriate), And Verified Contacts

Registrar safeguards block unauthorised movement, which means attackers cannot simply transfer the domain away.

• Transfer lock prevents transfers by default, which means ownership stays put unless deliberately changed.
• Registry lock (for high-value domains) adds an extra verification step, which means domain movement requires stronger proof.
• Verified contacts ensure notifications arrive, which means renewal and security alerts are not lost.

Do this today (10 minutes): Enable transfer lock on your primary and email domains and verify the registrant email and phone.

This is for: client-facing firms handling money movement instructions. This is not for: teams actively migrating domains this month.

Secure DNS Change Paths: Change Control, Break-Glass Accounts, And Logged Approvals

DNS changes act like rewiring your building's signage and mailroom in one step, which means control and logging matter.

Practical controls include:

• Written change requests (even a ticket), which means intent is documented.
• A break-glass account stored securely, which means recovery remains possible during identity outages.
• Approval logging, which means you can explain changes after the fact.

A real-world mistake we have seen: a rushed DNS edit before a client demo caused an MX typo, which means inbound mail failed for 47 minutes. The lesson was simple: DNS changes deserve a second pair of eyes.

Do this today (30 minutes): Decide where DNS changes are requested and approved (email, ticketing, Teams), then document the approval rule in one paragraph.

This is for: teams making periodic DNS changes. This is not for: firms with zero DNS change frequency (rare once SaaS grows).

Prevent ‘Dangling DNS’ And Subdomain Takeovers Before They Happen

One of the strangest discoveries during DNS reviews is seeing a subdomain pointing to a service that no longer exists.

That abandoned pointer can become an attacker's foothold, which means "old records" deserve active cleanup.

Understand The Failure Mode: How Abandoned DNS Records Get Weaponised

Dangling DNS often appears as a CNAME record pointing to a decommissioned SaaS endpoint, which means an attacker can sometimes claim the endpoint and serve content under your subdomain.

Common outcomes include:

• Phishing pages hosted at your subdomain, which means filters and users trust the URL.
• Cookie or session risk in some configurations, which means authentication boundaries can weaken.

Do this today (15 minutes): Pick three subdomains you no longer use (old portals, old campaigns) and verify whether the destination service still exists.

Run A Practical DNS Hygiene Check: CNAMEs To Decommissioned Services, Old A Records, Orparked Subdomains

A practical hygiene check focuses on high-signal records:

• CNAMEs to SaaS providers you no longer pay for, which means likely dangling targets.
• A records pointing to old IPs, which means exposure to reused hosting addresses.
• Parked subdomains, which means unnecessary attack surface.

During one internal test, we found 12 legacy records for a 30-person firm, which means nearly every year of "just one quick change" left residue.

Do this today (45 minutes): Export your DNS zone file and mark any record that nobody can explain within 2 minutes.

Set Guardrails: CAA Records, SPF/DKIM/DMARC Alignment, And Minimising Wildcards

Guardrails reduce misuse of your domain, which means less spoofing and fewer certificate surprises.

• CAA records restrict which Certificate Authorities can issue certificates, which means attackers have fewer routes to valid TLS certificates.
• SPF/DKIM/DMARC alignment improves email authenticity, which means spoofed emails are more likely to be rejected or quarantined.
• Minimising wildcard DNS reduces unintended subdomains, which means fewer places to hide.

Authoritative references help justify choices: SPF/DKIM/DMARC concepts are documented by organisations such as CISA, which means controls can be defended during client security reviews.

Do this today (30 minutes): Check whether DMARC exists for your domain and confirm the policy value matches your current email platform.

Coordinate With Certificate Management: Avoid TLS Renewal Surprises During Registrar Or DNS Changes

TLS certificates can fail after domain or DNS changes, which means client-facing portals may display browser warnings.

Key points:

• Certificate renewal depends on domain validation methods, which means DNS and registrar access can block renewals.
• Vendor-managed certificates still depend on correct DNS records, which means a cleanup can accidentally break validation.

Do this today (20 minutes): List every service that presents a certificate under your domain (website, portal, VPN) and note the renewal owner.

Implement Monitoring That Scales Beyond Email Reminders

Email reminders feel comforting until a spam filter catches them or a mailbox rule hides them.

Monitoring for domain security works best when checks are independent of one channel, which means you can detect problems before clients do.

Track Expiry Dates Centrally: A Domain Register With Owners, Renewal Dates, And Dependencies

A domain register becomes the single source of truth, which means handovers and audits become easier.

Minimum columns that work in practice:

Field	Why it matters	Outcome
Domain	Identifies the asset	Clear scope
Registrar	Shows control point	Faster response
Expiry date	Shows time risk	Predictable renewal
Owner + backup	Shows accountability	Less bus factor
Dependencies	Shows blast radius	Better prioritisation

Do this today (25 minutes): Add owners and expiry dates for your top 5 domains and share the register with Ops and Compliance.

Add Independent Checks: WHOIS/Registrar Status Monitoring And Alerting To Multiple Channels

Independent checks avoid reliance on registrar emails, which means early detection.

Options include:

• WHOIS status monitoring, which means visibility into expiry and lock changes.
• Alerts to Teams/Slack plus email, which means redundancy.
• A shared on-call phone number for critical alerts, which means response during travel.

Do this today (30 minutes): Configure alerts to at least two channels (email plus Teams) for expiry warnings at 90/60/30 days.

Use Synthetic Monitoring For What Users Feel: Website, MX Records, And Critical DNS Resolution

Synthetic monitoring checks user-facing symptoms, which means you see failures that matter.

Key tests:

• HTTP checks for website and portals, which means visibility into downtime.
• MX record resolution checks, which means early warning of email routing issues.
• DNS resolution tests from more than one region, which means detection of propagation or geo-DNS issues.

A simple target is 1–5 minute intervals for critical endpoints, which means problems surface quickly enough for containment.

Do this today (20 minutes): Set up a basic uptime check for your website and a DNS resolution check for your MX record.

Operationalise Alerts: Escalation Paths, On-Call Coverage, And ‘No Alert Left Behind' Rules

Alerts only help when somebody acts, which means operations design matters.

A workable rule set:

• An alert must have an owner, which means no orphan notifications.
• Escalation after 30 minutes for critical issues, which means reduced mean time to acknowledge.
• Coverage during public holidays, which means protection when staffing is light.

Do this today (15 minutes): Define one escalation path for domain expiry alerts (primary, backup, final approver) and publish it in a shared channel.Build A Renewal Runbook That Survives Holidays, Staff Changes, And Vendor Churn

A calm renewal feels almost boring. Boring is good. A runbook turns renewal into a repeatable choice rather than a last-minute scramble, which means fewer security incidents.

Standard Renewal Steps: Budget Approval, Renewal Execution, Verification, And Evidence Capture

A simple runbook usually includes:

1. Budget confirmation, which means renewal cannot fail on payment.
2. Renewal execution, which means the registrar status returns to active.
3. Verification (WHOIS and DNS), which means control is confirmed.
4. Evidence capture, which means audit questions get answered quickly.

Do this today (40 minutes): Write your renewal runbook as a one-page checklist and store it next to your Domain Evidence folder.

Post-Renewal Validation Checklist: WHOIS, Nameservers, DNSSEC (If Used), MX Records, And Web Certificate Continuity

Renewal alone does not guarantee service continuity, which means validation matters.

Post-renewal checks:

• WHOIS expiry date updated, which means renewal truly applied.
• Nameservers unchanged, which means no accidental DNS migration.
• DNSSEC status verified (if used), which means signed zones still validate.
• MX records resolve, which means email routes remain correct.
• Website certificate valid, which means browsers continue to trust your site.

Do this today (20 minutes): After your next renewal, run the checklist and attach screenshots to your evidence folder.

Third-Party Touchpoints: Agencies, Web Hosts, MSPs, How To Avoid Shared Responsibility Gaps

Agency arrangements often hide an uncomfortable truth: the agency controls the registrar, which means your firm cannot prove ownership quickly.

A better shared-responsibility stance:

• Your organisation remains registrant of record, which means legal control is clear.
• Vendors receive delegated access only, which means operational work continues without ownership risk.
• Written handover clauses exist, which means vendor churn does not become an incident.

Do this today (30 minutes): Ask each vendor who can access your registrar and DNS, then update access to match least privilege.

Safe Automation: When Auto-Renew Helps, When It's Risky, And How To Control It

Auto-renew reduces missed payments, which means fewer expiry incidents. Auto-renew can also fail quietly, which means monitoring remains essential.

Auto-renew works well when:

• Payment method is stable, which means renewals succeed.
• Renewal alerts still go to a monitored distribution list, which means failures get seen.

Auto-renew becomes risky when:

• A single corporate card expires, which means renewal fails silently.
• Registrar notices go to one person, which means holidays create blind spots.

Do this today (15 minutes): Keep auto-renew on for primary domains, then add a quarterly check that the payment method and alert recipients remain valid.

If A Domain Already Expired: Contain, Recover, And Prove Control Fast

Panic often starts with a small clue: a client replies, "Your email bounced." The first hour matters because attackers move quickly, which means containment has to be prioritised over perfect diagnosis.

Triage In The First Hour: Stop Spoofing, Stabilise Email, And Protect Clients From Fraud

First-hour goals focus on harm reduction:

• Block spoofing where possible (DMARC policy, mail gateway rules), which means fewer fraudulent emails reach clients.
• Stabilise email through alternate channels (temporary domain or provider support), which means internal coordination continues.
• Warn front-line staff about payment-change scams, which means human verification increases.

Do this today (10 minutes): Draft a short internal message template for "Domain or email instability" that reminds staff to verify payment instructions by phone.

Recovery Paths By Stage: Grace Period, Redemption, Pending Delete, And After Re-Registration

Recovery depends on timing:

• Grace period: renew immediately, which means service returns fastest.
• Redemption: pay recovery fees and regain control, which means cost rises but recovery is still likely.
• Pending delete: prepare for re-registration attempts and engage registrar support, which means you may need specialist help.
• After re-registration: pursue recovery via registrar, dispute, or legal channels, which means proof of prior ownership becomes critical.

Do this today (15 minutes): Save the last paid invoice and any WHOIS screenshots you have, which means you can prove prior control during escalation.

Communications Plan For Finance And Professional Services: Client Advisories Without Panic

Client comms should protect trust without amplifying fraud opportunities, which means clarity and restraint matter.

A practical advisory includes:

• What happened in plain language, which means fewer rumours.
• What clients should do (verify instructions), which means fraud risk drops.
• What clients should not do (do not trust payment changes by email), which means attackers lose a common path.

Do this today (20 minutes): Prepare a client advisory draft approved by Compliance, which means release time reduces during an incident.

Post-Incident Actions: Reset Registrar Credentials, Validate DNS Integrity, And Review Log Trails

Regaining a domain is not the finish line, which means integrity checks follow.

Post-incident actions:

• Reset registrar passwords and MFA, which means attackers lose persistent access.
• Validate nameservers and DNS records against a known-good baseline, which means hidden redirects are removed.
• Review registrar access logs (where available), which means you understand entry points.

Do this today (30 minutes): After any scare, compare current DNS records to last month's export and document differences.

Turn This Into A Repeatable Control: Update The Risk Register And Evidence For Audit Follow-Up

Incidents become useful when lessons become controls, which means follow-up work matters.

A minimal post-incident package:

• Updated risk register entry with likelihood and impact, which means governance improves.
• Evidence of control changes (screenshots, runbook updates), which means audits become smoother.
• A short timeline of events (five bullets), which means executive understanding improves.

Do this today (45 minutes): Write a one-page incident summary and attach it to your domain evidence folder for future due diligence.

Conclusion: A Domain Control Plan That Actually Works In Real Life

Your Minimum Standard: Governance, Hardening, Monitoring, And A Tested Recovery Runbook

A domain control plan works when four choices stay consistent: governance, hardening, monitoring, and a runbook that has been tried once under calm conditions. Domain security then becomes part of daily operational control, which means fewer surprises and fewer client-impacting incidents in Singapore.

Do this today (20 minutes): Pick your minimum standard for the next 30 days: assign owners, enable MFA and transfer lock, create a domain register, and schedule one recovery tabletop exercise.

Next Step: Schedule A No-Obligation Domain And DNS Control Review For Your Organisation

Teams in the Singapore CBD often prefer clarity over drama: a short review can surface forgotten domains, risky DNS records, and renewal single points of failure. Our background in fund services environments means the conversation naturally covers audit evidence and client trust expectations, which means the outcome is practical rather than theoretical.

Do this today (5 minutes): Start by requesting a no-obligation domain and DNS control review with our IT consulting and share your current domain list so the session stays focused.

Frequently Asked Questions

Why is protecting domains from expiring an information security issue, not just admin?

Protecting domains from expiring is a security control because expiry can break email and websites, then enable attackers to re-register your domain for phishing, malware, and Business Email Compromise (BEC). The historical trust, backlinks, and existing email threads make impersonation far more convincing and damaging.

What happens when a domain expires (grace period, redemption, pending delete)?

After expiry, DNS may stop resolving so web and email can fail immediately. Most registrars then offer a grace period (often 30–45 days) to renew at normal cost. Next is redemption with higher recovery fees (commonly £100+). After pending delete (about 5 days), it can drop to auction/re-registration.

How do I protect domains from expiring with a simple 90-day renewal process?

Use a “90-day rule”: at 90 days confirm contact details and payment method; at 60 days confirm the renewal decision and approvals; at 30 days renew or pre-pay multi-year for core domains. Share reminders with a role-based distribution list so holidays or resignations don’t create blind spots.

What business impact can domain expiry cause for email, SSO, and client services?

Domain expiry can trigger immediate email bounces, website errors, and knock-on failures in SSO, VPN, MDM enrolment, and client portals that depend on DNS. The impact is measurable: downtime productivity loss, higher BEC exposure via lookalike mailboxes, longer-lasting brand/SEO damage, and costly recovery fees plus emergency support.

What are the most important registrar and DNS controls to prevent domain takeover?

Start with strong registrar authentication (MFA or passkeys), verified registrant contacts, and transfer lock; consider registry lock for high-value domains. Reduce single points of failure with separate roles (billing vs DNS vs transfers), role-based registrar emails, and logged DNS change approval. These steps block common takeover paths.

If a domain has already expired, what should we do in the first hour?

Prioritise containment: attempt immediate renewal (or engage registrar support), stabilise communications using alternative channels, and reduce spoofing risk with mail gateway/DMARC controls where possible. Brief finance and client-facing staff to verify payment changes by phone. Preserve proof of prior ownership (invoices/WHOIS) for escalation.